{"id":"CVE-2021-23337","title":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","summary":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-94","CWE-78"],"vendor":"lodash","product":"lodash","affected":["lodash < 4.17.21","banking_corporate_lending_process_management = 14.2.0","banking_corporate_lending_process_management = 14.3.0","banking_corporate_lending_process_management = 14.5.0","banking_credit_facilities_process_management = 14.2.0","banking_credit_facilities_process_management = 14.3.0","banking_credit_facilities_process_management = 14.5.0","banking_extensibility_workbench = 14.2.0","banking_extensibility_workbench = 14.3.0","banking_extensibility_workbench = 14.5.0","banking_supply_chain_finance = 14.2.0","banking_supply_chain_finance = 14.3.0","banking_supply_chain_finance = 14.5.0","banking_trade_finance_process_management = 14.2.0","banking_trade_finance_process_management = 14.3.0","banking_trade_finance_process_management = 14.5.0","communications_cloud_native_core_binding_support_function = 1.9.0","communications_cloud_native_core_policy = 1.11.0","communications_design_studio = 7.4.2.0.0","communications_services_gatekeeper = 7.0","communications_session_border_controller = 8.4","communications_session_border_controller = 9.0","enterprise_communications_broker = 3.2.0","enterprise_communications_broker = 3.3.0","financial_services_crime_and_compliance_management_studio = 8.0.8.2.0","financial_services_crime_and_compliance_management_studio = 8.0.8.3.0","health_sciences_data_management_workbench = 2.5.2.1","health_sciences_data_management_workbench = 3.0.0.0","jd_edwards_enterpriseone_tools < 9.2.6.1","peoplesoft_enterprise_peopletools = 8.58","peoplesoft_enterprise_peopletools = 8.59","primavera_gateway >= 17.12.0, <= 17.12.11","primavera_gateway >= 18.8.0, <= 18.8.12","primavera_gateway >= 19.12.0, <= 19.12.11","primavera_gateway >= 20.12.0, <= 20.12.7","primavera_unifier >= 17.7, <= 17.12","primavera_unifier = 18.8","primavera_unifier = 19.12","primavera_unifier = 20.12","retail_customer_management_and_segmentation_foundation = 19.0","active_iq_unified_manager","cloud_manager","system_manager = 9.0","sinec_ins < 1.0","sinec_ins = 1.0"],"patched":["lodash 4.17.21","jd_edwards_enterpriseone_tools 9.2.6.1","sinec_ins 1.0"],"published":"2021-02-15","updated":"2026-10-08","sourceUpdated":"2026-10-08T22:17:07.363","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-23337","references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","label":"report@snyk.io"},{"url":"https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851","label":"report@snyk.io"},{"url":"https://security.netapp.com/advisory/ntap-20210312-0006/","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JS-LODASH-1040724","label":"report@snyk.io"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","label":"report@snyk.io"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"report@snyk.io"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","label":"report@snyk.io"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","label":"report@snyk.io"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20210312-0006/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JS-LODASH-1040724","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-23337.json"},{"url":"https://access.redhat.com/security/cve/CVE-2021-23337"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1928937"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23337"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23337"},{"url":"https://access.redhat.com/errata/RHSA-2021:2543"},{"url":"https://access.redhat.com/errata/RHSA-2022:6429"},{"url":"https://access.redhat.com/errata/RHSA-2021:2438"},{"url":"https://access.redhat.com/errata/RHSA-2021:3459"},{"url":"https://access.redhat.com/errata/RHSA-2021:2179"},{"url":"https://access.redhat.com/errata/RHSA-2026:7329"}],"tags":["nvd","exploit-available","csaf","vex","red-hat","cve.org"],"epss":0.21333,"epssPercentile":0.97588,"exploits":{"github":1,"githubRepos":["https://github.com/khayashi4337/lodash.template-fixed"],"nuclei":["CVE-2021-23337"],"checkedAt":"2026-10-27T16:39:23.991Z"},"exploitAvailable":true,"ingestedAt":"2026-10-08T23:16:47.314Z","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-08T21:08:30.418276Z"},"slug":"CVE-2021-23337","body":"## Overview\n\nLodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.\n\n## Affected\n\n- `lodash < 4.17.21`\n- `banking_corporate_lending_process_management = 14.2.0`\n- `banking_corporate_lending_process_management = 14.3.0`\n- `banking_corporate_lending_process_management = 14.5.0`\n- `banking_credit_facilities_process_management = 14.2.0`\n- `banking_credit_facilities_process_management = 14.3.0`\n- `banking_credit_facilities_process_management = 14.5.0`\n- `banking_extensibility_workbench = 14.2.0`\n- `banking_extensibility_workbench = 14.3.0`\n- `banking_extensibility_workbench = 14.5.0`\n- `banking_supply_chain_finance = 14.2.0`\n- `banking_supply_chain_finance = 14.3.0`\n- `banking_supply_chain_finance = 14.5.0`\n- `banking_trade_finance_process_management = 14.2.0`\n- `banking_trade_finance_process_management = 14.3.0`\n- `banking_trade_finance_process_management = 14.5.0`\n- `communications_cloud_native_core_binding_support_function = 1.9.0`\n- `communications_cloud_native_core_policy = 1.11.0`\n- `communications_design_studio = 7.4.2.0.0`\n- `communications_services_gatekeeper = 7.0`\n- `communications_session_border_controller = 8.4`\n- `communications_session_border_controller = 9.0`\n- `enterprise_communications_broker = 3.2.0`\n- `enterprise_communications_broker = 3.3.0`\n- `financial_services_crime_and_compliance_management_studio = 8.0.8.2.0`\n- `financial_services_crime_and_compliance_management_studio = 8.0.8.3.0`\n- `health_sciences_data_management_workbench = 2.5.2.1`\n- `health_sciences_data_management_workbench = 3.0.0.0`\n- `jd_edwards_enterpriseone_tools < 9.2.6.1`\n- `peoplesoft_enterprise_peopletools = 8.58`\n- `peoplesoft_enterprise_peopletools = 8.59`\n- `primavera_gateway >= 17.12.0, <= 17.12.11`\n- `primavera_gateway >= 18.8.0, <= 18.8.12`\n- `primavera_gateway >= 19.12.0, <= 19.12.11`\n- `primavera_gateway >= 20.12.0, <= 20.12.7`\n- `primavera_unifier >= 17.7, <= 17.12`\n- `primavera_unifier = 18.8`\n- `primavera_unifier = 19.12`\n- `primavera_unifier = 20.12`\n- `retail_customer_management_and_segmentation_foundation = 19.0`\n- `active_iq_unified_manager`\n- `cloud_manager`\n- `system_manager = 9.0`\n- `sinec_ins < 1.0`\n- `sinec_ins = 1.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `lodash 4.17.21`\n- `jd_edwards_enterpriseone_tools 9.2.6.1`\n- `sinec_ins 1.0`\n\n## Vendor advisories\n\n- **RHSA-2021:2543** · Red Hat · fixed in: Red Hat OpenShift Jaeger 1.20 · released 2021-06-24 · [advisory](https://access.redhat.com/errata/RHSA-2021:2543)\n- **RHSA-2022:6429** · Red Hat · fixed in: 8Base-RHMTC-1.7 · released 2022-09-13 · [advisory](https://access.redhat.com/errata/RHSA-2022:6429)\n- **RHSA-2021:2438** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.8 · released 2021-07-27 · [advisory](https://access.redhat.com/errata/RHSA-2021:2438)\n- **RHSA-2021:3459** · Red Hat · fixed in: Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts · released 2021-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2021:3459)\n- **RHSA-2021:2179** · Red Hat · fixed in: RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 · released 2021-06-01 · [advisory](https://access.redhat.com/errata/RHSA-2021:2179)\n- **RHSA-2026:7329** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-04-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:7329)\n- **Red Hat VEX** · Moderate · affected: OpenShift Service Mesh 2.0, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ansible Automation Platform 1.2, Red Hat OpenShift Container Platform 3.11, Red Hat OpenShift Container Platform 4, Red Hat Quay 3 · no fix planned: Red Hat OpenShift Container Platform 3.11, Red Hat OpenShift Container Platform 4, Red Hat Quay 3, OpenShift Service Mesh 2.0, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-23337.json)","depth":"midnight","depthScore":56,"depthScoreParts":{"impact":39.6,"likelihood":4.3,"exploitation":12,"ransomware":0},"changes":[]}